ar_doc_11 openssl_ECC_enc_dec_signature - JohnHau/mis GitHub Wiki

https://www.scottbrady91.com/openssl/creating-rsa-keys-using-openssl

Creating Elliptic Curve Keys using OpenSSL

Recently, I have been using OpenSSL to generate private keys and X509 certificates for Elliptic Curve Cryptography (ECC) and then using them in ASP.NET Core for token signing.

In this article, I’m going to show you how to use OpenSSL to generate private and public keys on the curve of your choice. Check out my other article for how to do the same for RSA keys.

tl;dr - OpenSSL ECDSA Cheat Sheet

find your curve

openssl ecparam -list_curves

generate a private key for a curve

openssl ecparam -name prime256v1 -genkey -noout -out private-key.pem

generate corresponding public key

openssl ec -in private-key.pem -pubout -out public-key.pem

optional: create a self-signed certificate

openssl req -new -x509 -key private-key.pem -out cert.pem -days 360

optional: convert pem to pfx

openssl pkcs12 -export -inkey private-key.pem -in cert.pem -out cert.pfx

Generating an Elliptic Curve Private Key Using OpenSSL To start, you will need to choose the curve you will be working with. You can use the following command to see a list of supported curve names and descriptions.

openssl ecparam -list_curves In this example, I am using prime256v1 (secp256r1), which is suitable for JWT signing; this is the curve used for JOSE’s ES256.

You can now generate a private key:

openssl ecparam -name prime256v1 -genkey -noout -out private-key.pem This should give you a PEM file containing your EC private key, which looks something like the following:

openssl ec -in private-key.pem -pubout -out public-key.pem This should give you another PEM file, containing the public key:

-----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEOr6rMmRRNKuZuwws/hWwFTM6ECEE aJGGARCJUO4UfoURl8b4JThGt8VDFKeR2i+ZxE+xh/wTBaJ/zvtSqZiNnQ== -----END PUBLIC KEY----- Creating an EC Self-Signed Certificate Using OpenSSL Now that you have a private key, you could use it to generate a self-signed certificate. This is not required, but it allows you to use the key for server/client authentication, or gain X509 specific functionality in technologies such as JWT and SAML.

openssl req -new -x509 -key private-key.pem -out cert.pem -days 360 This will again generate another PEM file, this time containing the certificate created by your private key:

You can do this using OpenSSL’s pkcs12 command:

openssl pkcs12 -export -inkey private-key.pem -in cert.pem -out cert.pfx OpenSSL will ask you to create a password for the PFX file. Feel free to leave this blank.

This should leave you with a certificate that Windows can both install and export the EC private key from.

////////////////////////////////////////////////////////////////////////////////////////////////////////

Creating RSA Keys using OpenSSL

Creating a private key for token signing doesn’t need to be a mystery. Recently, I wrote about using OpenSSL to create keys suitable for Elliptic Curve Cryptography (ECC), and in this article, I am going to show you how to do the same for RSA private and public keys, suitable for signature generation with RSASSA-PKCS1-v1_5 and RSASSA-PSS.

tl;dr - OpenSSL RSA Cheat Sheet

generate a private key with the correct length

openssl genrsa -out private-key.pem 3072

generate corresponding public key

openssl rsa -in private-key.pem -pubout -out public-key.pem

optional: create a self-signed certificate

openssl req -new -x509 -key private-key.pem -out cert.pem -days 360

optional: convert pem to pfx

openssl pkcs12 -export -inkey private-key.pem -in cert.pem -out cert.pfx Generating an RSA Private Key Using OpenSSL You can generate an RSA private key using the following command:

openssl genrsa -out private-key.pem 3072 In this example, I have used a key length of 3072 bits. While 2048 is the minimum key length supported by specifications such as JOSE, it is recommended that you use 3072. This gives you 128-bit security. This command also uses an exponent of 65537, which you’ve likely seen serialized as “AQAB”.

This gives you a PEM file containing your RSA private key, which should look something like the following:

Creating an RSA Public Key from a Private Key Using OpenSSL Now that you have your private key, you can use it to generate another PEM file, containing only your public key.

openssl rsa -in private-key.pem -pubout -out public-key.pem This should give you another PEM file, containing the public key:

-----BEGIN PUBLIC KEY----- MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEA1MSdsaPH2ShtjOo4c02+ DbYcTdwUBLY+vNSXr2tV8/jGU059Jak9CA7VSlKR/fik18D7Lq1beLjW56kV4Xvm 3qmpxOc3eNGmj8dqtO0G3Lp1FAZzxlu2SZsHmmVq9isZcN70apkwlDgIZ11NVIq/ 1iXzr0pIRMKkMNHTGBGBkYOrIcgdH2elvIqfiit6Gts/zho4YCjgyn/r3Vgy/jCu 6VbfwE9xVY/DB4srD5LrZMabRzN2YwSTI+sRqpbt7I7nZ6o8CuyqHDLjbO9VzE0p ovBshTfoyog9XGcQHwTmWn4bdnsh2I1x3gQpaqxdRs4vnKmXJ9GvC/sYla0GYXyD ecpgjITqx3QA6aKx9+EVh/o6owYTHXaToVkP7U5m8cqaloQFfA8HLsGDg9A0QaMt ixnX7KtT/ZvKFMcazRJ1GX42UaeuO1opZKtjBHLtmaPadNeZdD77VytwY2UHeW5Q Snfpos7IxUTATpd6KTWUV3snVQnyiltCI1BHJC01sWePAgMBAAE= -----END PUBLIC KEY----- Creating an RSA Self-Signed Certificate Using OpenSSL Now that you have a private key, you can use it to generate a self-signed certificate. This is not required, but it allows you to use the key for server/client authentication, or gain X509 specific functionality in technologies such as JWT and SAML.

openssl req -new -x509 -key private-key.pem -out cert.pem -days 360 This will again generate yet another PEM file, this time containing the certificate created by your private key:

You could leave things there, but often, when working on Windows, you will need to create a PFX file that contains both the certificate and the private key for you to export and use.

You can do this using OpenSSL’s pkcs12 command:

openssl pkcs12 -export -inkey private-key.pem -in cert.pem -out cert.pfx OpenSSL will ask you to create a password for the PFX file. Feel free to leave this blank.

This should leave you with a certificate that Windows can both install and export the RSA private key from.